Improper Handling of Case Sensitivity in fast-uri - CVE-2026-86472
Published: September 16, 2026
Vulnerability identifier: #VU150187
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-86472
CWE-ID: CWE-178
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass host allowlist or denylist checks.
The vulnerability exists due to improper handling of case sensitivity in the fast-uri host parsing, normalization, and equality functions when processing scheme-relative references containing percent-encoded uppercase unreserved host octets. A remote attacker can supply a crafted scheme-relative URL to bypass host allowlist or denylist checks.
The evading hostname resolves and routes to the same host intended to be restricted.
Affected software
fast-uri
Db2 Developer Extension
ApplinX
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Db2 Developer Extension
ApplinX
Automation Assets in IBM Cloud Pak for Integration (CP4I)
How to mitigate CVE-2026-86472
Install security update from vendor's website.
fast-uri - addressed in versions 2.4.7, 3.1.8, 4.1.5
Db2 Developer Extension - update to 1.2.1
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.26-sc2, 4.4.3
Db2 Developer Extension - update to 1.2.1
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.26-sc2, 4.4.3